Firewalls Don't Stop Dragons Podcast

The world wide web, as we know it today, has been around for over 30 years. In that time, most of us have created many dozens, perhaps hundreds, of online accounts. How many of those accounts are still alive somewhere? What data do they hold? And how good are the passwords you used? Today we’re going to start on the path to finding all those accounts which could drastically improve our privacy and security. In the news: millions of Dell laptops have critical security flaws you need to patch now; Facebook may be secretly scanning your phone’s images; National Public Data is back and you should delete your data; data brokers are flouting privacy laws; Ionic 5 owners in the UK will have to pay for a security fix; Flipper Zero devices are being (wrongly) blamed for auto thefts; the US Supreme Court allows Mississippi social media law to go into effect; data brokers are hiding their opt-out pages; app TeaOnHer exposed users’ data; UK backs down from Apple backdoor demand; and now is the time for EU residents to speak out against Chat Control. Article Links Millions of Dell laptops hit by ‘critical’ security vulnerability https://www.pcworld.com/article/2870014/millions-of-dell-laptops-hit-by-critical-security-vulnerability.html Meta might be secretly scanning your phone’s camera roll – how to check and turn it off https://www.zdnet.com/article/meta-might-be-secretly-scanning-your-phones-camera-roll-how-to-check-and-turn-it-off/ You Should Remove Your Info From the Rebooted National Public Data Site https://lifehacker.com/tech/remove-your-info-from-rebooted-national-public-data-site Data Brokers Are Ignoring Privacy Law. We Deserve Better. https://www.eff.org/deeplinks/2025/08/data-brokers-are-ignoring-privacy-law-we-deserve-better Hyundai wants Ioniq 5 owners to pay to fix a keyless entry security hole https://www.theverge.com/news/757205/hyundai-ioniq-5-security-upgrade-fix-game-boy-device-attacks Can Flipper Zero really steal your car? (Spoiler: NO) https://blog.flipper.net/can-flipper-zero-steal-your-car/ Supreme Court allows Mississippi social media law to go into effect https://www.npr.org/2025/08/14/nx-s1-5482925/scotus-netchoice Data Brokers Are Hiding Their Opt-Out Pages From Google Search https://www.wired.com/story/data-brokers-hiding-opt-out-pages-google-search/ How we found TeaOnHer spilling users’ driver’s licenses in less than 10 minutes | TechCrunch https://techcrunch.com/2025/08/13/how-we-found-teaonher-spilling-users-drivers-licenses-in-less-than-10-minutes/ UK blinks, backs down from its Apple backdoor encryption demand https://appleinsider.com/articles/25/08/19/uk-blinks-backs-down-from-its-apple-backdoor-encryption-demand Worried about Chat Control? This website can help you get your say https://www.techradar.com/computing/cyber-security/worried-about-chat-control-this-website-can-help-you-get-your-say Tip of the Week: Data Diet Introduction: https://firewallsdontstopdragons.com/data-diet-introduction/  Further Info Cory Doctorow on age verification: https://pluralistic.net/2025/08/14/bellovin/#wont-someone-think-of-the-cryptographers  Fight EU’s Chat Control: https://fightchatcontrol.eu/  My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support our mission! https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch  Table of Contents 0:00:00: Intro 0:01:37: News preview 0:05:00: Millions of Dell laptops hit by ‘critical’ security vulnerability 0:06:44: Meta might be secretly scanning your phone’s camera roll 0:12:00: You Should Remove Your Info From National Public Data 0:15:39: Data Brokers Are Ignoring Privacy Law 0:19:06: Hyundai wants Ioniq 5 owners to pay for security fix 0:22:43: Can Flipper Zero really steal your car? (No.) 0:30:38: Supreme Court allows Mississippi social media law to go into effect 0:34:35: Data Brokers Are Hiding Their Opt-Out Pages 0:43:35: We found TeaOnHer spilling users’ info in less than 10 minutes 0:49:17: UK backs down from its Apple backdoor demand 0:53:38: Having your say about Chat Control 0:58:41: Tip of the Week: Data Diet, Intro 1:02:52: Merlin’s Musings preview 1:04:21: Looking ahead

Monique Priestley, a Vermont State Representative and consumer protection advocate, shares her experiences navigating the complex world of privacy legislation. She reveals the hurdles faced in passing the Vermont Data Privacy Act and the strategies used against powerful Big Tech lobbyists. Discover the importance of collaboration among legislators, challenges of balancing privacy rights with corporate protection, and lessons learned for future advocacy efforts. Monique sheds light on the need for transparency and citizen involvement in shaping meaningful privacy laws.

It’s early August, which means it’s time for BSides Las Vegas and DEF CON, part of the trio of conferences that make up “hacker summer camp” (the other being Black Hat, which I don’t attend). It’s been a crazy, chaotic week – as usual – but in almost completely good ways. After the regular news, I’ve got some mini interviews with Jake Braun (DEF CON Franklin), Stacey Higginbotham (Consumer Reports), Cooper Quitin (EFF) and The Gibson (Veilid and hackers.town). In other news: Tea app users file a class action lawsuit over massive breach; ChatGPT sessions may be searchable by anyone; US government launches initiative to centralize health data for use by tech companies; Australia rolls out age verification for search engines; Grok AI is now in Teslas; China-backed hackers exploit horrific Microsoft bug; Dropbox ends its password manager service. Article Links Tea User Files Class Action After Women’s Safety App Exposes Data https://www.404media.co/tea-user-files-class-action-after-womens-safety-app-exposes-data/ ChatGPT users shocked to learn their chats were in Google search results https://arstechnica.com/tech-policy/2025/08/chatgpt-users-shocked-to-learn-their-chats-were-in-google-search-results/ Trump administration is launching a new private health tracking system with Big Tech’s help https://apnews.com/article/trump-ai-rfk-jr-health-tech-fa73703bd1fd557c787ef0b590e151f1 Australia is quietly rolling out age checks for search engines like Google https://www.abc.net.au/news/2025-07-11/age-verification-search-engines/105516256 Grok is now in Tesla cars, but not in the way you think https://mashable.com/article/grok-tesla China-backed hackers used Microsoft flaw in attacks https://www.washingtonpost.com/technology/2025/07/21/china-hackers-microsoft-sharepoint/ Users left scrambling for a plan B as Dropbox drops Dropbox Passwords https://www.theregister.com/2025/07/30/dropbox_drops_dropbox_passwords/ Tip of the Week: https://firewallsdontstopdragons.com/how-to-backup-cloud-data/  Further Info Top hacker interviews: https://fdsd.me/hackers   DEF CON Franklin: https://defconfranklin.com/ EFF: https://www.eff.org/ Veilid: https://veilid.com/ Consumer Reports: https://securityplanner.consumerreports.org/ My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support our mission! https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch  Table of Contents 0:00:00: Intro 0:02:24: News preview 0:03:31: Tea User Files Class Action Lawsuit 0:06:24: ChatGPT users shocked to learn their chats were in Google search results 0:11:11: Trump administration is launching a new private health tracking system 0:17:52: Australia is quietly rolling out age checks for search engines 0:22:56: Grok is now in Tesla cars, but not in the way you think 0:25:29: China-backed hackers used Microsoft flaw in attacks 0:29:50: Dropbox drops Dropbox Passwords 0:32:20: Tip of the Week 0:36:27: Hacker Summer Camp Extras! 0:42:53: SNIPPET: Stacey Higginbotham 0:47:03: SNIPPET: Jack Braun 0:50:18: SNIPPET: Cooper Quintin and Gibson 0:55:04: Wrapup

Cory Doctorow has garnered a lot of needed attention to the decline of modern online platforms, including Google Search, Facebook and Twitter. Much of this is a result of coining the now-viral term Enshittification. Today we’ll talk about how the internet was broken and who’s to blame. We’ll also discuss the lack of privacy laws and the threats of AI to tech workers and copyrighted works. Finally, we’ll discuss Cory’s novel proposal for how countries could respond to US tariffs by ripping up intellectual property agreements, changing the power dynamic of the Big Tech industry and hopefully benefiting consumers in the process. Interview Notes Cory’s blog (Pluralistic): https://pluralistic.net/  Canada shouldn’t retaliate with US tariffs: https://pluralistic.net/2025/01/15/beauty-eh/#its-the-only-war-the-yankees-lost-except-for-vietnam-and-also-the-alamo-and-the-bay-of-ham  Who Broke the Internet? https://www.cbc.ca/listen/cbc-podcasts/1353-the-naked-emperor  Enshittification book (coming Oct 2025): https://us.macmillan.com/books/9780374619329/enshittification/  Regex: https://en.wikipedia.org/wiki/Regular_expression  Copyright and AI: https://www.technologyreview.com/2025/07/01/1119486/ai-copyright-meta-anthropic/  Further Info Humble Bundle: https://www.humblebundle.com/books/security-apress-books  My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support the mission: https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch  Table of Contents 0:00:00: Intro 0:02:07: Humble Bundle! 0:03:09: Interview preview 0:06:52: Has coining the term Enshittification helped to raise awareness? 0:11:08: Who broke the internet? 0:20:15: Will AI reduce tech workers’ power? 0:27:21: Why can we not get privacy laws? 0:35:21: How should countries respond to US tariffs? 0:39:57: Do DRM protections incentize creators? 0:44:37: What’s your take on the Anthropic AI copyright decision? 0:55:03: What’s next for you? 0:56:04: Interview wrap-up 0:57:27: Hacker summer camp 0:59:28: Patron podcast preview 1:00:24: Looking ahead

Explore how our phones, essential in daily life, can compromise personal data if physically accessed. Discover new iOS and Android features that bolster your phone’s security. Learn about the surge in VPN usage in the UK spurred by privacy concerns following new regulations. Dive into the ethics of data privacy in dating apps and examine ways to minimize your digital footprint amidst rising surveillance. Also, gain insights on AI's role in privacy and the importance of making informed choices for protecting your personal information.

We talk a lot about digital or online security. Today we’re going to focus on physical security and the general ethos of “be prepared”. There are many situations in life when you will find yourself wishing you had had the foresight to acquire certain things or establish certain professional relationships before you actually needed them. Deviant Ollam is a physical penetration specialist. His job is to find and fix weaknesses in physical things… buildings, locks, safes, etc. And along the way he has learned some important lessons for all of us. Today he will share his wisdom with us. Interview Notes Deviant’s website: https://deviating.net/  Lawyer,Passport, Locksmith, Gun talk: https://www.youtube.com/watch?v=6ihrGNGesfI  Attacking Classified Safes & Vaults: https://www.youtube.com/watch?v=-Z_Jv7vuiqg  Red Team Alliance: https://shop.redteamalliance.com/  Red Team Tools: https://www.redteamtools.com/  CackalackyCon: https://www.cackalackycon.org/  Shut the F**k Up PSA: https://www.youtube.com/watch?v=nWEpW6KOZDs  Home lock – Schlage Primus: https://commercial.schlage.com/en/products/key-systems/primus-security-upgrade.html  Padlock – Pacific Lock (PACLOCK): https://paclock.com/  Further Info My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support the mission: https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch  Table of Contents 0:00:00: Intro 0:04:27: What is a physical entry specialist? 0:08:47: How would you describe the prepper ethos? 0:12:21: What are common mistakes for disaster prep? 0:15:52: What should everyone have a passport? 0:20:32: Why should everyone have an established lawyer? 0:28:55: What other professionals should I have at the ready? 0:34:09: What locks should I use or avoid? 0:40:39: Do any movies and TV shows portray lock picking correctly? 0:43:36: What is ‘responsible disclosure’ like for physical vulnerabilities? 0:47:44: Do you tell companies when you stumble on physical vulnerabilities? 0:51:41: What documents should we have physical copies of? 0:55:27: If I’m politically active, how can I minimize my digital footprint? 0:59:10: Why should we use secure, private communications? 1:02:34: What’s next for you? 1:06:05: Wrap-up 1:08:45: Patron podcast preview

Your cell phone number uniquely identifies you. Many companies rely on this 1-to-1 relationship to authenticate you to their systems. So if someone were to somehow manage to steal your mobile phone number – a hack called SIM swapping – they could use that to impersonate you and compromise any of your accounts that are validated via SMS or phone call. There’s a new tool to combat this scam that’s better than the old-style account PIN codes. I’ll explain how it works. In the news: many Brother printers have serious cyber vulnerabilities; Belkin in abandoning Wemo smart devices next January; Xfinity’s WiFi routers can detect motion in your entire home; Bluesky is rolling out age verification in the UK; California is using drones to catch the use of illegal fireworks; McDonald’s AI hiring bot was hacked to expose millions of applicants’ data; Mexican drug cartel hacked FBI phone to catch informants; US strikes blow against North Korean fake worker scams; Denmark is looking to ditch Microsoft products. Article Links New Vulnerabilities Expose Millions of Brother Printers to Hacking https://www.securityweek.com/new-vulnerabilities-expose-millions-of-brother-printers-to-hacking/  Belkin pulls the plug on Wemo smart home products which will stop working in 2026 https://9to5google.com/2025/07/10/belkin-wemo-smart-home-shutdown-list/  Using WiFi Motion in the Xfinity app https://www.xfinity.com/support/articles/wifi-motion  Bluesky is rolling out age verification in the UK https://www.theverge.com/news/704468/bluesky-age-verification-uk-online-safety-act  Huge fines coming for Californians caught by drone with illegal fireworks https://www.sfgate.com/bayarea/article/california-drones-illegal-fireworks-20629637.php  McDonald’s AI Hiring Bot Exposed Millions of Applicants’ Data https://www.wired.com/story/mcdonalds-ai-hiring-chat-bot-paradoxai/  Drug cartel hacked FBI official’s phone to track and kill informants https://arstechnica.com/security/2025/06/mexican-drug-cartel-hacked-fbi-officials-phone-to-track-informant-report-says/  Identities of More Than 80 Americans Stolen for North Korean IT Worker Scams https://www.wired.com/story/identities-of-80-plus-americans-stolen-for-north-korean-it-worker-scams/  Why Denmark is dumping Microsoft Office and Windows for LibreOffice and Linux https://www.zdnet.com/article/why-denmark-is-dumping-microsoft-office-and-windows-for-libreoffice-and-linux/  Tip of the Week: https://firewallsdontstopdragons.com/freezing-your-mobile-account/  Further Info Tom’s Hardware on WiFi Motion: https://www.tomshardware.com/networking/routers/new-xfinity-router-motion-detecting-feature-stokes-privacy-fears-feature-powered-by-wi-fi-signals  RockYou password list: https://cybernews.com/security/rockyou2024-largest-password-compilation-leak/  LibreOffice: https://www.libreoffice.org/discover/libreoffice/  Eurostack: https://eurostack.eu/  Running Linux in a VM on Windows: https://itsfoss.com/install-linux-mint-in-virtualbox/  Age verification: https://www.privacyguides.org/articles/2025/05/06/age-verification-wants-your-face/  My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support our mission! https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch  Table of Contents 0:00:00: Intro 0:00:17: DEF CON coming up fast 0:03:34: News preview 0:06:31: New Vulnerabilities Expose Millions of Brother Printers to Hacking 0:11:51: Belkin pulls the plug on Wemo smart home products 0:14:25: Using WiFi Motion in the Xfinity app 0:21:19: Bluesky is rolling out age verification in the UK 0:26:49: Huge fines coming for Californians caught by drone with illegal fireworks 0:29:36: McDonald’s AI Hiring Bot Exposed Millions of Applicants’ Data 0:35:31: Drug cartel hacked FBI official’s phone to track and kill informants 0:39:54: Identities of More Than 80 Americans Stolen for North Korean IT Worker Scams 0:48:33: Why Denmark is dumping Microsoft Office and Windows for LibreOffice and Linux 0:55:48: Tip of the Week 1:01:37: Merch reminder 1:02:12: Patron podcast preview 1:02:45: Looking ahead

Privacy risks are bad enough for adults – but it’s much worse for our kids, particularly as students. Who provides notice and obtains consent for minors at school? In many cases it’s not the parents, let alone the students – it’s the school system. Not only are they opting the students into invasive data collection by profit-driven third parties, but they often also bind them to mandatory arbitration clauses, neutering their ability to seek legal redress for the inevitable violations. Today I’ll discuss this horrid state of affairs with someone who is on the front lines of this battle for our children’s right to privacy: co-founder of the EdTech Law Center, Andy Liddell. Interview Notes EdTech Law Center: https://edtech.law/about-us/  EdTech current cases: https://edtech.law/cases/  Internet Safety Labs: https://internetsafetylabs.org/  The Right to Oblivion (book): https://www.hup.harvard.edu/books/9780674260528  ACLU, Digital Dystopia: https://www.aclu.org/publications/digital-dystopia-the-danger-in-buying-what-the-edtech-surveillance-industry-is-selling  The Markup, College Prep Software Naviance Is Selling Advertising Access to Millions of Students: https://themarkup.org/machine-learning/2022/01/13/college-prep-software-naviance-is-selling-advertising-access-to-millions-of-students  Proton blog on EdTech and privacy: https://proton.me/blog/ed-tech-trackers  Further Info My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support the mission: https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch  Table of Contents 0:00:00: Intro 0:02:48: What’s your mission at the EdTech Law Center? 0:05:20: What are the unique privacy threats for students? 0:09:46: What privacy laws are there for minors? 0:12:05: How are these laws enforced and litigated? 0:18:21: How does notice and consent work for students? 0:27:05: What rights do the kids have in these situations? 0:29:38: How are these EdTech companies? 0:31:40: Which apps and tools are most problematic and why? 0:37:20: Should minors’s data be deleted when they reach adulthood? 0:40:15: Are school systems equipped to understand these contracts? 0:42:35: What about privacy issues with EdTech hardware? 0:45:50: What have we already learned via discovery or reporting? 0:50:01: As a parent, who do I talk to about my child’s privacy risks at school? 0:54:16: What are some red flags to look out for? 0:57:10: What responsibilities do school systems have here? 1:00:57: So what can we do? When should we reach out to you? 1:05:02: Interview follow-up 1:06:26: Patron podcast preview 1:07:19: Looking ahead

Discover how mobile apps might be compromising your privacy through in-app browsers that track and serve ads. Delve into the alarming privacy pitfalls of the Meta AI app and new developments involving 23andMe's data handling. Learn about Amazon and Roku's ad-sharing collaboration, along with rising government surveillance tactics. Explore crucial security updates for Windows 10 and Android 16, and hear about Denmark's proposals on AI-generated deep fakes. Empower yourself with actionable steps to better protect your data!

On January 12th, 2025, the ShmooCon hacker conference held it’s 20th and final gathering. I was lucky enough to be able to not only attend the final show but also to interview the founders, Heidi and Bruce Potter. We talk about how it all got started, what made this hacker con so special and beloved, and hear some hilarious stories from the past twenty years of hacker shenanigans in Washington D.C. Interview Notes ShmooCon: https://www.shmoocon.org/  ShmooCon 2025 sessions: https://www.youtube.com/playlist?list=PLnKSfJ5rXw95HSPVl5L7dqhKpVAx3q_j0  Turngate: https://www.turngate.io/  HOPE conference: https://www.hope.net/  BSides: https://bsides.org/  Cackalackycon: https://cackalackycon.org/  Thotcon: https://www.thotcon.org/  SummerCon: https://www.summercon.org/  PancakesCon: https://pancakescon.com/  Further Info My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support the mission: https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Recommend news stories: send to news [at] firewallsdontstopdragons.com  Send me your questions! https://fdsd.me/qna  Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch  Table of Contents 0:00:00: Intro 0:03:43: How and why did you start ShmooCon? 0:11:05: Why are hacker conferences so different from regular trade shows? 0:17:19: Why limit attendence and how did this give rise to LobbyCon? 0:21:52: What makes a good con? What’s your post-con recovery like? 0:27:26: Why did you decide to end the con? 0:29:54: How have other cons influenced ShmooCon? 0:33:16: Why is it important to be so transparent about your con? 0:37:38: What are your favorite ShmooCon stories? 0:44:54: What’s it like running a conference as a married couple? 0:49:39: What are you most proud of with ShmooCon? 0:52:13: Was there anything you wish you had done but didn’t? 0:56:07: Did you ever consider handing ShmooCon off to someone else? 0:58:13: So what now? 1:00:58: What are some ShmooCon alternatives? 1:06:36: Wrap-up 1:08:07: Attend a hacker con! 1:09:35: Patron bonus preview 1:10:24: Looking ahead